Subject: [core] Fwd: TLS Cached Information Extension - version 11

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 26 Dec 2011 11:50:07 +0200

With the updated version of the draft there is an open issue you guys 
may have input to offer.

-------- Original Message --------
Subject: TLS Cached Information Extension - version 11
Date: Mon, 26 Dec 2011 11:46:58 +0200
From: Hannes Tschofenig <[email-masked]>
To: [email-masked]
CC: [email-masked]

Hi all,

Nikos provided review comments (see
http://www.ietf.org/mail-archive/web/tls/current/msg08338.html) and I
have incorporated them in version 11 of the draft:
http://www.ietf.org/internet-drafts/draft-ietf-tls-cached-info-11.txt

As you can see, there are a number of smaller changes here and there. I
hope that readability has improved.

There is an open issue: algorithm negotiation

Currently, the draft defines a registry for hash algorithms that are
used to produce the hashes of cached information. The client can tell
the server that it has already cached, for example, the certificate
chain. The server then has to only send the fingerprint of it (rather
than the complete certificate chain). The other information (besides
certificate chains) that can be "fingerprinted" is the list of trusted
CAs. Does this cover all use cases?

A few algorithms are defined, namely SHA-1, SHA-224, SHA-256, SHA-384,
SHA-512. Is this a good list to start with?

The draft does not define a way for the client to tell the server that
it only supports a certain hash algorithm. Should we allow the client to
indicate what algorithm it supports?

Ciao
Hannes